Aflac Japan Customer Data Exposed
Aflac Japan Discloses Data Breach Exposing 4.38 Million Customer Records
Key Points
My Number, credit card numbers and health status at contract time were not included in the leaked data.
The breach hit the Aflac Yoriso Net portal, a policyholder site that lets customers check contract details and make changes.
First unauthorized access occurred on June 15, with multiple intrusions confirmed through June 25, and unusual activity detected on June 25.
About 40,000 agencies were affected, with leaked information including agency representatives' names, addresses and telephone numbers.
Aflac Life Insurance Japan disclosed a major data breach on June 30, 2026, confirming that hackers stole personal data on roughly 4.38 million customers. Attackers first broke in on June 15 and were not detected until June 25, giving them ten days of access to customer records, according to SecurityWeek.
The breach hit the Aflac Yoriso Net portal, a customer-facing site where policyholders check contract details and make changes. For about 230,000 of those records, bank account information used for premium payments was also exposed, Bleeping Computer reported.
Ten Days of Undetected Access Before Alarm Sounds
The first intrusion hit Aflac Japan's systems on June 15. Multiple waves of unauthorized access then continued for ten days without triggering a response. Aflac Japan only spotted the breach on June 25, when engineers noticed an abnormal spike in system traffic, according to SecurityWeek.
Once the company identified the intrusion, it blocked further access and began shutting down affected systems. External cybersecurity experts were brought in to conduct a forensic audit. Aflac filed a formal disclosure with the U.S. Securities and Exchange Commission on June 30, GuruFocus noted.
Bank Account Numbers Among the Stolen Records
The leaked data includes names, addresses, phone numbers, and policy numbers for 4.38 million customers. For roughly 230,000 of those people, hackers also got bank account details — including bank name, branch, account type, and account number — used to pay insurance premiums, Bleeping Computer reported.
About 40,000 sales agency records were also compromised, exposing the names, addresses, and phone numbers of agency representatives. Aflac stressed that Japan's national ID number, known as My Number, as well as credit card numbers and health status at the time of contract were not part of the leaked data, TipRanks noted.
Regulators Move In as Aflac Issues Public Apology
Aflac Japan notified Japan's Financial Services Agency and other authorities after the breach was confirmed. The company issued a public apology for the "inconvenience and anxiety" caused to customers — a critical step in Japan to maintain public trust, according to SecurityWeek.
The FSA could issue a business improvement order if the investigation reveals systemic security failures, particularly since Aflac Japan suffered a separate breach in January 2023 that exposed data on 3.2 million cancer insurance policyholders. Aflac Japan confirmed that no misuse of the leaked information has been confirmed so far, GuruFocus reported.
Services Move to Call Centers While Portal Stays Down
With the Yoriso Net portal suspended, Aflac Japan shifted policy changes and customer inquiries to call centers. Claims processing continues through alternative channels while the investigation proceeds. The company said it will notify affected individuals in stages as the review moves forward, Bleeping Computer reported.
Security analysts warn that even without credit card or national ID data, the combination of bank account numbers and home addresses gives criminals enough detail for highly targeted phone scams and fraud. Aflac reported total revenues of $4.3 billion for Q1 2026, giving it significant financial capacity to cover remediation and notification costs.
Sentiment
Mostly NegativePublishers
11
Articles
2
Reach
13
